Beamsplitting attack to the revised KKKP protocol and a possible solution 
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revised scheme can be used for not-so-weak coherent state quantum key distribution. 
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Quantum key distribution (QKD) can help two legal 
parties (Alice and Bob) to accomplish unconditionally se- 
cure communications which is an impossible task by any 
classical method . The security of QKD is guaranteed 
by known principles of quantum mechanics 0.0.01 rather 
than the assumed computational complexity in classical 
secure communication. It is one of the most promising 
applications of quantum information science and the gap 
between theory and practice has become narrower. 

Single-photon QKD was the first being theoretically 
investigated |5[, experimentally realized |6( and proved 
to be secure |^|. However, the imperfect single-photon 
source leads the QKD protocol vulnerable to the pho- 
ton number splitting (PNS) attack which limits its 
application in practice. Therefore, several revised pro- 
tocols have been proposed using weak-coherent states 
[H El EH [HI • I* 1 particular, the classical process of basis 
reconciliation may be an important source of informa- 
tion leakage to an eavesdropper, known as Eve 0. Very 
recently Kye et al. \l2\ proposed a blind polarization, 
where the sender and the receiver share key information 
by exchanging qubits with arbitrary polarization angles 
without basis reconciliation. (There is another protocol 
where basis reconciliation is not necessary The so- 

called KKKP protocol, named after the inventors' ini- 
tials E3i was thought to be secure even when a key 
is embedded in a not-so-weak coherent-state pulse be- 
cause only randomly polarized photons are exchanged as 
another important advantage. The KKKP protocol has 
generated considerable interests 0, 0] 

Despite its advantages, the KKKP has been found vul- 
nerable to impersonation attacks, due to the fact that a 
key has to travel three times between the legitimate users. 
As shown in [J^, the original KKKP protocol is in- 
secure even if because of a mathematical loophole even 
for single-photon keys. The loophole has then been im- 
mediately filled up [13] and the protocol has been made 
secure for single-photon keys. However, the strength of 
the KKKP protocol lies in the possibility to use coherent- 



state keys of reasonable intensity. If Alice is limited to 
a single photon source, the protocol seems to be rather 
inefficient compared with the prior art standard proto- 
cols. In this Letter, we show the revised KKKP protocol 
is still insecure for coherent-state keys, and furthermore, 
we give a solution, which is robust against impersonation 
attacks. 

Consider the revised KKKP protocol 0. (Here we 
slightly simplify the protocol to perform (n/2) rotations, 
rather than (n/4) rotations.) : Kl. Alice sends Bob two 
coherent pulses with polarization angles 6q,0i. (For the 
ease of presentation, we shall use subscripts "0, 1" rather 
than "1,2".) K2. After reception, Bob applies random 
shuffling U y [4> + so(7r/2)] <g> U y [(j> + Si(7t/2)] where Sj is 
randomly chosen from {0, 1} and (i = 0, 1). Bob sends 
the two pulses back to Alice. K3. Upon reception, Alice 
applies U y [-9 + k(n/2)} ® U y [-Bi + (k © 1)(tt/2)] and 
k 6 {0, 1} is the key bit. Alice blocks one pulse and 
sends the other one back to Bob. The polarization angle 
of the surviving pulse is <p + ( s b © k © b)(n/2), and b is 
the blocking factor for Alice to send out pulse (b=0) 
or pulse 1 (b=l). K4. Bob applies U y (—<f)) to the only 
pulse he receives and measures the polarization angle. 
The measurement outcome reveals the value I = S{,ffifc©6. 
Alice announces b and Bob uses k = l(Bb®Sb as the secret 
bit shared with Alice. 

We show our attack by two arguments. A: If Eve 
knows the parity value, sq © 8%, she can attack the pro- 
tocol successfully. B: There is indeed a way for Eve 
to know the value So © s± without causing any distur- 
bance to Alice or Bob's detection. The B can be ex- 
pected from the following fact: When s © si = 0, the 
protocol reduces to the single pulse KKKP protocol 0] 
actually, because Bob shuffles both qubits by the same 
degree. When so © s\ = 1, the protocol also reduces 
to the (double pulse) KKKP protocol E2> because Bob 
shuffles the qubits always differently. In both cases, the 
protocol can be successfully attacked by Eve. The former 
and the latter cases are dealt with in Refs. 0] and [lij . 
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respectively. 

Now we show A with an impersonation attack where 
to Alice, Eve pretends herself to be Bob, while to Bob, 
Eve pretends herself to be Alice in their quantum com- 
munication channel. We assume that Eve does not attack 
the classical communication between Alice and Bob. 
Protocol A: Al. After Kl, Eve intercepts both pulses 
from Alice and stores them in set El. Meanwhile, Eve 
prepares two coherent pulses by herself with polariza- 
tion angles 0' ,9' 1 . A2. After K2, Eve intercepts both 
pulses from Bob. After the treatment in the subpro- 
tocol As, Eve stores the remaining pulses intercepted 
from Bob in set E2. Suppose with subprotocol As, Eve 
now knows the value sq © Si. A3. If sq © Si = 0, 
Eve rotates the polarization of pulses in set El by 

U yW + s'oi^/ 2 )} ® U yW + s o( 7r / 2 )] and sends tnem t0 
Alice. Note that s' is set by Eve herself. After K3, 

Eve intercepts the only pulse from Alice and measures 
its polarization after a rotation of U y (— 4>'). The out- 
come reveals V = k © s' . Since s' is set by Eve her- 
self, Eve knows the value k already. Eve rotates pulse 

in set E 2 by U y (—8' + k{%/2)) and sends it to Bob. 
As Alice has expected in the protocol, Bob will obtain 

1 = k © Sb for sure after he measures the polarization. If 
So ® Si = 1, Eve rotates the polarization of pulses in set 
El by U y [4>' + s l Q {%/2)]®U v [<l>' + (s © 1)(tt/2)] and sends 
them to Alice. After K3, Eve intercepts the only pulse 
from Alice and measures its polarization after a rotation 
of U y {—4>'). As one may easily see, the outcome is simply 
V = Sq © k © b. Since s' Q is set by herself, Eve already 
knows the value k © b. Eve rotates pulse in set E 2 by 
U y (-6' + (fcffi b)(n/2)) and sends it to Bob. Bob will for 
sure obtain I — k © b © s;,, as Alice has expected in the 
protocol. Since b is announced later, Eve can obtain k 
by k = (k © b) © b. 

Protocol A shows that Eve may have full informa- 
tion about Bob's result without causing any noise, if she 
knows the value sq © Si. We now show that she can in- 
deed know this by subprotocol As: Consider Fig. 1. 
After K2, Bob sends two pulses BO and Bl back to Al- 
ice. Eve intercepts them and splits each of them by a 
beamsplitter. To know the value of sq © si is simply to 
know whether the two pulses (defined as E0 and El) have 
the same polarization angle. Eve first observes whether 
each pulse contains at least one photon by a quantum 
non-demolition measurement. If yes, she takes one pho- 
ton from each pulse and then guides them to a 50:50 
beamsplitter after rotating the polarization of pulse E0 
and pulse El by —9 07 —9i, respectively. As it has been 
well known , if the polarization of two input photons 
are the same, one output beam must be vacuum. There- 
fore if she observes one photon on each output ports, 
she concludes that so © si = 1, otherwise, the result 
is inconclusive. Before guiding pulses E0 and El into 
a 50:50 beamsplitter, Eve may choose to rotate the po- 
larization of beam E0 by ir/2. In such a case, if she 



observes one photon on each output ports, she concludes 
that So © si = 0, otherwise, the result is inconclusive. 
Also, if initially E0 or El is vacuum, the result is incon- 
clusive. If the result is inconclusive, Eve intercepts and 
discards everything from Alice and Bob in protocol A. 
If the result is conclusive, Eve continues her protocol A 
with the exact information of so © s\. (After subprotocol 
B, the pulses E0 and El are consumed already and Eve 
shall store pulses and 1 in set E2 for protocol A.) This 
attack protocol may sound plausible. However, there is a 
limitation for it due to a high probability of inconclusive 
events. The total of 75%, Eve gets inconclusive events, 
and only 25% of the case can be used. The best strategy 
for Eve is to prepare each pulses of B0 and SI in photon- 
number eigenstates containing at least 2 photons. In this 
case, only with the probability of 25%, Bob will receive 
any photons. Alice and Bob know in advance the bit 
rate, depending on their channel efficiency and coherent 
pulse amplitude Alice initially prepares. In [l2j| . when 
the channel efficiency is as low as rj 2 = 0.5 and the initial 
amplitude of Alice's pulse is 2.83, the successful detec- 
tion of a photon by Bob is calculated as 63.5%. Thus 
25% is too low to be unnoticed by Alice and Eve. If Eve 
prepares Bq and B\ in coherent states of amplitude 7, 
the problem will become more serious as the coherent 
states already have non-zero probability of there being 
no photons. 

Here, we confirm that what we discussed above is the 
optimum discrimination of the two qubits in parallel or 
anti-parallell polarizations (See 0])- Eve can have more 
setups to measure so © s\. For example, Eve increases 
the photon numbers of B0 and Bl and take two set of 
single photons from the pulses returning from Bob. She 
then have two beam splitter setup: one setup to give a 
conclusive event from the two qubits being in the same 
polarization and the other from them being in the anti- 
parallel polarization. This can however take enormous 
resources from Eve. Of course, Eve can use spy pulses 
in a singlet state to find if Bob's operations are same 
or orthogonal for the two pulses but we stick to only 
impersonation attack as this will suffice our needs as seen 
later. 

Moreover, in the present form of the revised KKKP 
protocol, Bob does not randomly change the intensity 
or phase of the two pulses before he sends them back to 
Alice therefore the two pulses sent out from Bob have the 
same intensity and they are phase-locked. In such a case, 
we can improve it using coherent state attack and photon 
number discriminator detector is not to be necessary. 

If two coherent fields of the same amplitude are in- 
puts to a beam splitter 0] , we know that the coherent 
state will be driven into only one output port. Let us 
assume that Eve prepares with a relatively large inten- 
sity fields (amplitude is 7). Eve sends them to Bob as 
she impersonates Alice to Bob. Upon reception of the 
pulses, Bob adds rotations and shuffling factors. As is 
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FIG. 1: Eve can know the value so ffisi by detecting beam EO 
and El appropriately. BSO and BSl are two identical beam 
splitters. Pulses and 1 are stored in set E2. Beams BO and 
Bl are sent by Bob after step K2. 



shown in Fig. 2, receiving the pulses from Bob, Eve will 
first split the pulses by a beamsplitter 1 (BSl). The co- 
herent fields reflected by BSl (amplitude ry, where r is 
the reflectivity of BSl) will be used to measure sO © si 
and the transmitted field (amplitude tj, where t is the 
transmissivity) will be stored and eventually sent back to 
Bob. The reflected pulses will be further split into two 
by a 50:50 beam splitter (BS2). The reflected pulses of 
BS2 will be used to measure if the two pulses are parallel 
to each other, while the transmitted pulses will be used 
to check if they are orthogonal. Here we only consider 
the orthogonal measure. The first and second are split by 
the dynamic reflector (DR) to give a time delay to the 
first pulse to meet the second at a 50:50 beam splitter 
(BS3). If they are of the same polarization, both pulses 
will be detected in photon detector 1 (PDl). The am- 
plitude of the coherent field to PDl is -\Z2rj and if they 
are orthogonal, they do not interfere and the amplitude 
of coherent fields to PDl and PD2 are both 7-7. If Eve 
detects any photon, then it is due to the fact that the 
two were orthogonal. 

Here, we remind that for a non-zero amplitude coher- 
ent field, there is non-zero probability of no photon de- 
tected so there is also a chance of inconclusive events. 
The success probability is calculated using the Poisso- 
nian nature of coherent state. P S uccess = (1 — e _r 7 ) 2 . 
Similarly, Eve measures if two pulses are parallel to each 
other by rotating the polarization angle of one of the 
pulses by tt/2. The success probability is again P s , 
Therefore, the total probability of success is also P s ., 

Eve then let the pulses go to Bob in the conclusive 
cases for which Bob still has a probability of receiving 
zero photons as a coherent state of £7 will travel to Bob. 
The total probability of Bob receiving any photons then 
is Pb = P S uccess(l — e~* 7 ). Eve knows the bit rate 
so she can make Pb to make it equal to the bit rate by 
changing 7. Eve then has implemented the subprotocol 
As successfully without having her action noticed by Al- 
ice and Bob. The revised KKKP protocol, with the idea 
being interesting, in its present form does not offer the 
security as it has been supposed therefore a more care- 
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FIG. 2: Scheme for Eve to find if the two coherent pulses are 
of orthogonal or parallel polarization. DR: dynamic reflector 
to reflect only the first pulse while the second pulse is let to 
transmit. BS: beam splitters. PD: photo detectors 



ful investigation is needed for real applications. Now we 
offer a possible solution. 

Consider the following protocol W: 
Wl: same with step Kl of KKKP protocol. W2: Upon 
reception, Bob applies random shuffling U y [<fi+so(ir/2))(£) 
U y [(j> + <S(tt/4) +Si(tt/2)] where Sl G {0, 1}(< G 0,1), 
8 € {0, 1} are random numbers. Bob sends the two pulses 
back to Alice. W3: Upon reception, Alice decides ran- 
domly to either use the received pulses for test or continue 
the protocol for sharing a secret bit with Bob. If she de- 
cides to continue, she applies U y [— 6 +k(-K /2)}®U y [— 6\ + 
fc(7r/2)] and k G {0, 1} is the key bit. Alice blocks one 
pulse and sends the other one back to Bob. (Alice also 
detects the blocked pulse to make sure that this is not in 
vacuum.) The polarization angle of the surviving pulse is 
4>+(s b ®k(3b)(ir/2) + b8(ir/4), and b is trie blocking factor 
for Alice to send out pulse (b=0) or pulse 1 (b=l). Al- 
ternatively, Alice may decide to consume the pulses from 
Bob to inspect the presence of Eve who tries to detect 
the blocking factor b by sending her two different pulses 
of photon-number eigenstates (Eve cannot use coherent 
pulses of different amplitude because it is not possible 
to tag them as two coherent states are not orthogonal). 
In order to do the test, she can use the coherent-state 
comparison technique as used by Eve described above. 
In this case, when the two coherent-state pulses of the 
same amplitudes should be driven to only one output 
port while the two photon-number eigenstates of differ- 
ent photon numbers would appear in the both output 
ports. Of course, there also is some non-zero probabil- 
ity of two photon-number eigenstates to appear in only 
one output port. Alice can check the probability of the 
all-or-nothing events and if it is less than desired she will 
have to abolish the keys assuming there having been Eve 
in the middle. W4. Bob applies U y [-<j> - A(w/4)] to 
the only pulse he receives and measures the polarization 
angle. Pulse 1 is randomly chosen from or 8. If A hap- 
pens to be equal to b5, the measurement outcome reveals 
the value I = k © b © s&. Alice announces b and Bob 
uses k = I © b © si, as the secret bit shared with Alice if 
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A = bS. If A ^ b6, they discard the data. W5. They run 
the above program for N times. W6. Alice announces 
which times she has used the pulses for test in step W3. 
Bob announces the values of 5 and sq,si he has chosen 
for those times. Alice only needs to consider those test- 
ing results where her rotation angle (jj(tt/4) happens to 
be equal to [2(so + si) — 5}(n/4). If they are all single- 
clickings, she judges that there is no Eve, otherwise, she 
aborts the protocol. W7. Alice and Bob also compare 
some of their bits through classical communications to 
see whether they have indeed shared the same key. 

In the protocol above, there are two different types of 
error tests. Step W6 is to test whether there is Eve who 
tries to detect the blocking factor b by sending Alice two 
different pulses. W7 is to test whether there is Eve who 
tries to know k or equivalently, Sq © s\. Given protocol 
W, Eve cannot use the subprotocol B to obtain s © 
Si without causing any noise. Say, no matter how she 
rotates beam EO or El, any value of sq © si can cause the 
event of two-fold clicking. Without the exact information 
about so © si at that time, she cannot continue protocol 
A because she would cause noise in Bob's key and this 
may be detected in step W7. 

In summary, we have shown that the revised KKKP 
protocol|lfij in its present form fails under a type of 
beamsplitter attack. We also propose a protocol which 
is robust against any impersonation attack. 
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